Loneliness First Aid

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

The skill is mostly conversational and supportive, but it asks for calendar and filesystem access that its own instructions do not need.

Review this skill before installing. Its loneliness advice appears coherent, but the requested filesystem and calendar permissions are broader than the documented behavior needs. Prefer a version that removes those tool requirements and pins the installer version or otherwise verifies the install source.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Unnecessary Filesystem and Calendar Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–14
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Complete Code Snippet:

yaml

openclaw:
  requires:
    tools: [calendar, filesystem]

Technical Analysis

The skill declares access to both the calendar and filesystem tools, but none of its documented behavior requires reading or modifying files or accessing calendar information. Its operational instructions only provide conversational guidance concerning loneliness, social outreach, and crisis resources.

This discrepancy violates the principle of least privilege. If the host grants the declared capabilities, the skill receives access beyond what is necessary for its stated purpose. Although the reviewed instructions do not currently invoke these tools maliciously, unnecessary permissions increase the consequences of a future malicious update, instruction injection, or other compromise.

Attack Path

1. A user installs or activates the skill.
2. The hosting agent grants the declared calendar and filesystem capabilities.
3. The skill instructions are subsequently compromised, maliciously updated, or influenced by untrusted content.
4. The compromised execution path invokes the unnecessarily available tools.
5. Depending on host-side controls, local files or calendar records could be read, created, changed, or deleted without a legitimate need.

Impact Assessment

The potential scope includes data and operations exposed through the host's filesystem and calendar tool implementations. This could include disclosure of sensitive local files or calendar entries and unauthorized modification or deletion of accessible data. The exact privileges depend on the sandboxing, authorization, and confirmation controls enforced by the host platform.

Remediation

View remediation

Remediation Suggestions

• Remove both tool requirements because the current skill workflow is entirely conversational:

  yaml

  openclaw:
    requires:
      tools: []
  

• If a future scheduling feature genuinely requires calendar access, request only calendar access and only when the user explicitly asks to create or modify an event.

• Do not grant filesystem access unless a documented feature requires it.

• Apply read-only scopes where possible and require explicit confirmation before writes or deletions.

• Enforce host-side sandboxing and path or calendar-resource allowlists so manifest declarations alone cannot provide unrestricted access.

• Add a permission-to-feature review check to prevent future releases from declaring capabilities that are not exercised by documented functionality.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Complete Code Snippet:

yaml

install: "npx clawhub install loneliness-first-aid"

Technical Analysis

The installation command invokes clawhub through npx without specifying a package version or integrity constraint. If the package is not already available locally, npx may retrieve and execute the package resolved by the configured registry.

Consequently, the code executed during installation is not immutably tied to the version reviewed with this skill. A later compromised release, registry-account takeover, or other supply-chain incident could cause the same documented command to execute different code. The project contains no lockfile, integrity hash, vendored installer, or other material that would permit verification of the executable package in this audit.

Attack Path

1. An attacker compromises the registry package, its publisher account, or a future package release.
2. The attacker publishes a malicious version under the package name resolved as clawhub.
3. A user runs npx clawhub install loneliness-first-aid as documented.
4. npx resolves and downloads the compromised package because no reviewed version is pinned.
5. The package executes with the operating-system privileges of the invoking user.
6. The malicious package can perform any action permitted to that user before or during installation.

Impact Assessment

Successful exploitation could result in arbitrary local code execution under the installer user's privileges. Depending on those privileges and environmental controls, the malicious dependency could access user-readable files, steal credentials available to the process, alter project or user files, install additional components, or communicate with external systems. No malicious clawhub package is included or demon ...[truncated 108 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer to a specifically reviewed package version rather than resolving the current release implicitly, for example:

  yaml

  install: "npx --yes clawhub@<reviewed-version> install loneliness-first-aid"
  

• Replace the placeholder with an exact reviewed version; do not use latest, broad version ranges, or floating tags.

• Use a lockfile or an installation mechanism that verifies package integrity hashes.

• Document the expected official registry and package publisher, and reject resolution from untrusted registries.

• Prefer a preinstalled, centrally managed installer over downloading and executing package code during each installation.

• Run installation in a restricted environment with minimal filesystem, network, credential, and operating-system privileges.

• Re-audit the pinned installer before updating its version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The install instruction uses npx clawhub install loneliness-first-aid without pinning a specific package version. That means whoever runs it may fetch whatever version is current at execution time, creating a supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly. The skill’s mental-health content does not reduce this risk because the exposure comes from the installation path, not the subject matter.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.